Grafana OSS CVE-2026-28379

Exploitation requires a valid Grafana account at minimum Viewer privilege (CVSS PR:L confirmed); unauthenticated access is not sufficient. The Grafana Live subsystem must be reachable - it is enabled by default in standard Grafana OSS deployments, so no non-default configuration is needed on the server side. Attack complexity is rated Low (AC:L), meaning the race condition can be triggered reliably without precise timing or specialized knowledge, likely through simple concurrent HTTP tooling. Exploitation is limited to authenticated users and to Grafana OSS specifically; Grafana Enterprise is not listed as affected. SSVC rates automatable: no, indicating mass scanning/automated exploitation across the internet is not straightforwardly achievable, which aligns with the low EPSS percentile.

The CVSS 6.5 Medium score reflects a network-reachable (AV:N), low-complexity (AC:L), low-privilege (PR:L) attack with no user interaction required and a high availability impact (A:H), but no confidentiality or integrity impact. Taken alone, the AC:L rating is notable for a race condition - it implies the timing window is wide enough to be reliably exploitable without specialized tooling. Counterbalancing this, EPSS at 0.04% (12th percentile) and SSVC signals of exploitation: none and automatable: no collectively indicate no observed opportunistic or mass exploitation. SSVC technical impact is rated partial, consistent with the scoped (S:U) CVSS vector - the blast radius is limited to Grafana service availability and does not extend to the underlying host. KEV status is absent, and no POC has been identified. The realistic threat profile is a malicious or careless authenticated insider, or an attacker who has already obtained any Grafana credential, deliberately causing a service outage. For organizations relying on Grafana for production observability, the cascading impact of dashboard unavailability during an incident may amplify operational harm beyond what CVSS alone conveys.

An attacker authenticates to Grafana with any Viewer-level account - the lowest privilege tier - and sends a burst of concurrent HTTP or WebSocket requests targeting Grafana Live endpoints. The concurrent access races on an unprotected internal map, triggering a fatal Go runtime panic that terminates the Grafana process and renders the observability platform unavailable until an operator manually restarts it.